<< Click to display table of contents >> Navigation:  Introduction > Setting up Single Sign On with Entra ID

TiCon supports Single Sign-On with Microsoft Entra ID (formerly Azure Active Directory). The following steps are necessary to set this up:

1. Registration of TiCon as an app in the Azure Directory

1.1. Access the Azure Portal:https://portal.azure.com and log in or: Direct link to the App Registrations area, in this case continue with 1.4.

1.2. Click "Entra ID"

1.3. Click App Registrations in the navigation menu on the left

1.4. then click +New registration to add a new registration and enter a name

1.5.Complete the Application registration

1.6.Single tenantselect

1.7.Under "Redirect URI" (optional), select "Public client/native (mobile & desktop)"

1.8.in the Authentication area, add Platform configuration Mobile and desktop applications and enter as Redirect URI „https://localhost

1.9.Select App-Registration >TiCon API Permissions.

1.10.Click +Add a permission to add a new permission.

1.11.In the following window, select Microsoft Graph select

1.12.Application permissionsselect

1.13.Grant the following Permissions.

The following permissions must be granted: openid; User.Read; User.ReadBasic.All; User.Read.All; Group.Read.All
This allows the Entra ID users and groups to be read out with TiCon4.
The status must be Granted for..., i.e. an authorized user must still approve these permissions.

1.14.Click Register to complete the registration.

1.15.Then open the new registration and copy the Application (Client) ID and theDirectory (Tenant) ID, as these are required in TiCon4.

2. Saving the Application (Client) ID in TiCon Administration

2.1.Start TiCon

2.2.Open TiCon-Admin

2.3.Under "Program" → "General" insert the " Application (Client) ID " and "Directory (Tenant) ID" (see above) and save

2.4.A dialog for logging into the Azure Portal appears

2.5.There are two ways to log in:

2.6.Use an Azure user who has administrator authorization for app registrations in Azure and grant permission (consent)

2.7.Use an Azure user who does NOT have administrator authorization for app registrations in Azure. In this case, three variants can occur:

a.Azure is configured so that the user cannot make a "Request" to the administrator.
In this case, registration via Entra ID is not possible.

b.Azure is configured so that the user can make a "Request" for the authorization.
Enter a justification and submit a request (Request).
After confirmation by the administrator, it is possible to log in to TiCon.
If the waiting time for confirmation is unacceptable, close TiCon and repeat steps 1–5. In this case, option C applies.

c.Permission ("Consent") for the app has already been granted.
In this case, it does not matter which Azure user you use.
TiCon saves the changes and can use the Entra ID from then on

Notes on switching from "Active Directory" to "Microsoft Entra ID"

▪Users created via Microsoft Entra ID can have the same login name as Microsoft Entra ID users, but are considered new users.

▪After creating the Microsoft Entra ID users, the "Transfer user" function can be used to transfer all data of the former Active Directory users to the new Microsoft Entra ID users.

▪Alternatively, after entering the Application (Client) ID in the database, the SSID of the AD users can be replaced with the SSID from Microsoft Entra ID.

▪This allows all users to sign in via Microsoft Entra ID while retaining all personal settings and element ownership.

▪The SSIDs can be found in the "ACTAD0E" table.

Troubleshooting

▪In some cases, Entra ID needs a few minutes until everything is updated and it is possible to log in to TiCon.

▪To test which data is supplied for a user, you can call up the "Query "https://graph.microsoft.com/v1.0/me under "https://developer.microsoft.com/en-us/graph/graph-explorer".
Important: The user must be logged in, otherwise sample data will be displayed.